VDB
CVE-2008-3896
CVE-2008-3896
PUBLISHED
CVSS 2.0999999046325684 LOW
Grub Legacy 0.97 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
EPSS 0.35% · 28.0th percentile
Risk Scores
CVSS 2.0
2.0999999046325684
EPSS Score
0.35%
28.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| gnu | grub_legacy | *, 0, 0.92 |
| n/a | n/a | n/a |
Timeline
- Sep 3, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 30, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 16, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 31, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 15, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 9, 2023 EPSS Score
- Jun 2, 2023 EPSS Score
References
- 20080825 [IVIZ-08-009] Grub Legacy Security Model bypass exploiting wrong BIOS API usage mailing-list
- 4206 third-party-advisory
- 4204 third-party-advisory
- http://www.ivizsecurity.com/preboot-patch.html url
- http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf url
- https://nvd.nist.gov/vuln/detail/CVE-2008-3896 advisory